MAL-2026-18209: Malicious code in @ecg-internal/js-react-i18n collects host data
Summary
MAL-2026-18209: The malicious package collects host and environment identifiers and sends them to an external endpoint, exposing build-system information. Affects @ecg-internal/js-react-i18n versions 1.0.0 – 99.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
@ecg-internal/js-react-i18n is an npm package written in JavaScript. Its name implies internationalization functionality for React, but the reported package provides a stub main module whose properties resolve to no-op functions. The package is identified as malicious, and its reported behavior runs during installation and when the main module is imported.
Vulnerability Detail
The package performs malicious data collection, sending host and environment identifiers to an external endpoint. Its beacon.cjs code gathers the installer's hostname, install path, current working directory, Node.js version, and package name, then sends them over plain HTTP to a hardcoded IP address. The beacon runs through the declared postinstall script and a top-level call in the main module. The package does not provide the i18n functionality its name suggests.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @ecg-internal/js-react-i18nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Remove @ecg-internal/js-react-i18n and rotate all secrets and keys stored on any computer where it was installed, using a different computer. Treat affected systems as compromised; removal alone may not eliminate other malicious software.
Documented mitigation:
require('./beacon.cjs').fire()
Conclusion
No safe fixed version is published; remove the package and treat systems where it ran as compromised. Rotate stored secrets and keys from a different computer, since removing the package may not remove other malicious software. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for @ecg-internal/js-react-i18n →
FAQ
@ecg-internal/js-react-i18n is reported across the affected range introduced at 0; listed versions include 1.0.0, 1.0.1, 1.1.0, 2.0.0, and 99.0.1.
@ecg-internal/js-react-i18n collects host and environment identifiers and sends them to an external endpoint, exposing information about the build system.
No safe fixed version is published for @ecg-internal/js-react-i18n; remove the package rather than upgrading to another version.
Remove @ecg-internal/js-react-i18n as soon as possible, restrict access to affected systems, and rotate stored secrets and keys from a different computer.
Search package-lock.json for @ecg-internal/js-react-i18n. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
